What is an Encryption at Rest?

This protects against a different threat than encryption in transit: not someone intercepting network traffic, but someone who obtains a stolen disk, a database dump, or unauthorized filesystem access. A common and strong approach is AES-256-GCM, an authenticated encryption mode that both encrypts the data and lets the reader verify it hasn't been tampered with. Encryption without a matching, tested decryption path is a liability disguised as a control — data that gets encrypted but can never be correctly decrypted is effectively lost, so mature implementations always pair the encrypt path with a round-trip test. Key management is the other pillar: keys should live in a dedicated secret store separate from the encrypted data itself, and rotation should support a current-plus-previous overlap window so existing ciphertext doesn't break the moment a key rotates. Regulatory frameworks (SOC 2, HIPAA, GDPR) generally treat encryption at rest as a baseline expectation for any system storing sensitive data, particularly credentials, tokens, and personal information.